Optical network physical layer key distribution method and system based on server hardware features

Abstract

The application discloses a kind of optical network physical layer key distribution methods and systems based on server hardware features, it is related to information security technical field, the optical network physical layer key distribution methods and systems based on server hardware features disclosed, hardware feature code is generated by the inherent characteristics of depth fusion server hardware and optical network physical layer dynamic environment parameter, and key distribution is carried out in combination with public key infrastructure framework, effectively solve the technical problems that traditional software algorithm is vulnerable to intrusion, key randomness is insufficient and environment adaptability is poor, can improve the security of key distribution, enhance the randomness and uniqueness of key, improve the adaptability of system to environmental change.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of information security, in particular to an optical network physical layer key distribution method and system based on server hardware features. BACKGROUND

[0002] Under the background of the era of rapid development of digital information, the security of data transmission has become a core challenge in the global communication field. As a key component of modern information infrastructure, optical networks have high bandwidth and low latency, and the security protection of their physical layer directly determines the reliability and confidentiality of the entire communication link. However, the current mainstream key distribution technology mainly relies on software algorithms, and such methods have exposed multiple security risks in practical applications. On the one hand, software algorithms are extremely vulnerable to intrusion and tampering by malicious programs during key generation and distribution, such as viruses or Trojans that can intercept key information, leading to key leakage and thus compromising the integrity and confidentiality of data transmission. On the other hand, traditional schemes lack randomness at the hardware level, and the generated keys are often highly repetitive and lack uniqueness, making it easy for attackers to deduce the keys through brute force or side channel analysis, and unable to effectively deal with advanced persistent threats. In addition, existing technologies fail to fully utilize the inherent uniqueness of server hardware and the dynamic environmental parameters of optical network physical layer, such as real-time changes in temperature fluctuations and mechanical stress, resulting in a lack of environmental adaptability and anti-interference ability in the key distribution process, making it difficult to maintain long-term security in complex network attack scenarios.

[0003] The above content is only used to assist in understanding the technical solutions of the present application and does not represent the acknowledgement of the above content as prior art. SUMMARY

[0004] The main purpose of the present application is to provide an optical network physical layer key distribution method and system based on server hardware features, aiming to improve the security of key distribution.

[0005] To achieve the above purpose, the present application provides an optical network physical layer key distribution method based on server hardware features, which comprises:

[0006] The server hardware feature extraction module obtains server hardware information data, server real-time running data and optical network physical layer characteristic data, and performs combination processing to generate a hardware feature code;

[0007] A random number seed and the hardware feature code are used to generate a public key certificate based on a public key infrastructure framework;

[0008] The hardware feature code is processed using a secure hash algorithm to generate a key, and the public key certificate is used for authentication processing through a secure channel to distribute the key to both parties of communication;

[0009] The transmission data is processed by a symmetric encryption algorithm using the key to obtain encrypted data, the encrypted data is transmitted through the optical network physical layer, and the encrypted data is decrypted by the receiving party using the key to recover the transmission data.

[0010] In an embodiment, the step of obtaining server hardware information data, server real-time running data and optical network physical layer characteristic data by a server hardware feature extraction module and performing combination processing to generate a hardware feature code includes:

[0011] Obtaining server hardware information data by a server hardware feature extraction module; the server hardware information data includes CPU serial number data, motherboard serial number data and hard disk serial number data;

[0012] Obtaining server real-time running data by a server hardware feature extraction module; the server real-time running data includes CPU load data, memory occupancy data and disk I / O data;

[0013] Obtaining optical network physical layer characteristic data by a server hardware feature extraction module; the optical network physical layer characteristic data includes polarization mode dispersion data, temperature data, mechanical stress data and equipment vibration data;

[0014] Consistently combining the server hardware information data, the server real-time running data and the optical network physical layer characteristic data to generate the hardware feature code.

[0015] In an embodiment, the step of consistently combining the server hardware information data, the server real-time running data and the optical network physical layer characteristic data to generate the hardware feature code includes:

[0016] Performing correlation calculation processing on the server hardware information data, the server real-time running data and the optical network physical layer characteristic data to quantify the consistency between data;

[0017] Based on the results of the correlation calculation processing, performing normalization and fusion processing on the data to generate the hardware feature code.

[0018] In an embodiment, the step of generating a public key certificate based on a public key infrastructure framework using a random number seed and the hardware feature code includes:

[0019] Obtaining the random number seed and combining it with the hardware feature code to generate key pair data;

[0020] The key pair data is inputted into a certificate authority of a public key infrastructure framework for signature and verification processing to generate the public key certificate.

[0021] In one embodiment, the step of inputting the key pair data into a certificate authority of a public key infrastructure framework for signature and verification processing to generate the public key certificate comprises:

[0022] The key pair data is signed using a digital signature algorithm to obtain signature data;

[0023] The signature data is bound and verified with server identity information to generate the public key certificate.

[0024] In one embodiment, the step of processing the hardware feature code using a secure hash algorithm to generate a key and authenticating using the public key certificate to distribute the key to both parties of communication over a secure channel comprises:

[0025] The hardware feature code is inputted into a secure hash algorithm module for processing to generate the key of a fixed length;

[0026] The key is distributed over a secure channel by a key agreement protocol and authenticated using the public key certificate to ensure the security and anti-forgery of the key during transmission.

[0027] In one embodiment, the step of inputting the hardware feature code into a secure hash algorithm module for processing to generate the key of a fixed length comprises:

[0028] The hardware feature code is inputted as an input and processed by an iterative compression function to generate intermediate hash data;

[0029] The intermediate hash data is processed for length adjustment and output formatting to generate the key of the fixed length.

[0030] In one embodiment, the step of using the key to process transmission data using a symmetric encryption algorithm to obtain encrypted data and transmitting the encrypted data over an optical network physical layer comprises:

[0031] The transmission data is processed using the key for block processing and round function iteration to obtain encrypted block data;

[0032] The encrypted block data is combined into the encrypted data and transmitted over a fiber channel of the optical network physical layer.

[0033] In one embodiment, the method further comprises:

[0034] Real-time monitoring of encrypted data in the physical layer transmission process of an optical network to detect whether there is abnormal transmission behavior;

[0035] If abnormal transmission behavior is detected, the transmission is immediately interrupted, a security warning mechanism is started, and relevant information about the abnormal transmission is recorded for subsequent analysis and processing.

[0036] In addition, to achieve the above-mentioned purpose, the present application also proposes a server hardware feature-based optical network physical layer key distribution system, which comprises a memory, a processor, and a server hardware feature-based optical network physical layer key distribution program stored on the memory and executable on the processor, and the server hardware feature-based optical network physical layer key distribution program is configured to implement the steps of the server hardware feature-based optical network physical layer key distribution method.

[0037] The server hardware feature-based optical network physical layer key distribution method and system proposed in the present application generate a hardware feature code by deeply integrating the inherent features of server hardware and dynamic environmental parameters of the optical network physical layer, and perform key distribution in combination with a public key infrastructure framework, effectively solving the technical problems of traditional software algorithms being vulnerable to intrusion, insufficient randomness of keys, and poor environmental adaptability, and improving the security of key distribution, enhancing the randomness and uniqueness of keys, and improving the adaptability of the system to environmental changes. BRIEF DESCRIPTION OF DRAWINGS

[0038] The accompanying drawings, which are incorporated into and form part of the specification, illustrate embodiments consistent with the present application and, together with the specification, serve to explain the principles of the application.

[0039] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the accompanying drawings needed to be used in the embodiment or prior art description will be briefly introduced as follows. Obviously, for those skilled in the art, other drawings can also be obtained without creative labor based on these drawings.

[0040] Figure 1 A flowchart is provided for an embodiment of the server hardware feature-based optical network physical layer key distribution method of the present application;

[0041] Figure 2 A structural diagram is provided for an embodiment of the server hardware feature-based optical network physical layer key distribution system of the present application.

[0042] Explanation of the reference signs:

[0043] 10, memory; 20, processor.

[0044] The objectives, functional features and advantages of the present application will be further described with reference to the embodiments and the accompanying drawings. DETAILED DESCRIPTION

[0045] The technical solutions in the present application will be described clearly and completely below with reference to the accompanying drawings. Obviously, the described embodiments are only some of the embodiments of the present application, but not all the embodiments. The components of the present application described and shown in the accompanying drawings can be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of the present application provided in the accompanying drawings is not intended to limit the scope of the present application, but only represents selected embodiments of the present application. Based on the embodiments of the present application, all other embodiments obtained by those skilled in the art without creative work fall within the scope of the present application.

[0046] It should be understood that similar reference numerals and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in subsequent drawings. Meanwhile, in the description of the present application, the terms "first", "second", etc. are only used to distinguish the description, and cannot be understood as indicating or implying relative importance.

[0047] In the prior art, the current mainstream key distribution technology mainly relies on software algorithm implementation. Such methods expose multiple security risks in actual application. On the one hand, software algorithms are extremely vulnerable to intrusion and tampering by malicious programs in the key generation and distribution process, for example, viruses or Trojans can intercept key information, leading to key leakage, and thus destroying the integrity and confidentiality of data transmission. On the other hand, the traditional scheme lacks randomness sources at the hardware level, and the generated keys are often highly repetitive and lack uniqueness, making it easy for attackers to deduce the keys through brute force or side channel analysis, and unable to effectively deal with advanced persistent threats. In addition, the existing technology fails to fully utilize the inherent uniqueness of server hardware and the dynamic environmental parameters of the optical network physical layer, such as temperature fluctuations, mechanical stress, and other real-time changing factors, resulting in a lack of environmental adaptability and anti-interference ability in the key distribution process, making it difficult to maintain long-term security in complex network attack scenarios.

[0048] Based on this, the embodiments of the present application provide an optical network physical layer key distribution method based on server hardware features, referring to Figure 1 , the optical network physical layer key distribution method based on server hardware features comprises steps S100-S400, wherein:

[0049] Step S100, obtaining server hardware information data, server real-time running data and optical network physical layer characteristic data through a server hardware feature extraction module, and performing combination processing to generate a hardware feature code;

[0050] Step S200, using the random number seed and the hardware feature code, based on the public key infrastructure framework, certificate generation processing is performed to generate a public key certificate;

[0051] Step S300, the hardware feature code is processed using a secure hash algorithm to generate a key, and the public key certificate is used for authentication processing through a secure channel to distribute the key to the communication parties;

[0052] Step S400, using the key, the transmission data is processed by a symmetric encryption algorithm to obtain encrypted data, the encrypted data is transmitted through the optical network physical layer, and the receiving party uses the key to decrypt the encrypted data to recover the transmission data.

[0053] In this embodiment, the server hardware feature extraction module can be understood as a functional unit for collecting and integrating multi-source data, which mainly functions to obtain static information related to server hardware, dynamic running state and optical network physical layer environment parameters. Specifically, server hardware information data can be achieved by reading device identifiers or hardware configuration files, such as motherboard model data, network card MAC address data, etc.; server real-time running data can be obtained by monitoring tools, such as CPU temperature data, network bandwidth occupation data, etc.; optical network physical layer characteristic data can be collected by sensors or signal analysis devices, such as optical power fluctuation data, fiber bending loss data, etc. The combination processing of these data can be achieved in various ways, such as weighted summation after time stamp alignment, or using feature vector splicing to generate hardware feature code.

[0054] In this embodiment, the introduction of random number seed can enhance the unpredictability of the key generation process. In practical applications, random number seed can be generated in various ways, such as collecting environmental noise based on physical noise source random number generator, or using user behavior data (such as mouse movement trajectory, keyboard tapping interval) as entropy source. The combination processing of random number seed and hardware feature code can be achieved by XOR operation, hash mapping, etc., so as to ensure that the generated key has high randomness and uniqueness.

[0055] In this embodiment, the selection of the secure hash algorithm can be flexibly adjusted according to actual needs, for example, standardized algorithms such as SHA-256, SHA-3, or custom hash functions to achieve a specific length of output. In the key distribution process, the establishment of a secure channel can rely on various technical means, such as tunnel encryption technology based on IPSec protocol, or using quantum key distribution technology to achieve higher levels of security. By integrating server hardware features and optical network physical layer characteristics, the present application constructs a dynamic and unique key generation mechanism. Compared with the traditional method of simply relying on software algorithms to generate keys, this method takes advantage of the inherent properties of hardware and the non-reproducibility of physical layer environment parameters, fundamentally improving the randomness and attack resistance of the key. At the same time, by embedding the hardware feature code into the public key infrastructure framework, a strong association between the certificate and the hardware entity is achieved, avoiding the risk of certificate forgery in traditional public key infrastructures. In addition, the generation and distribution of keys combine multi-source dynamic data and security authentication mechanisms, further enhancing the confidentiality and integrity of key transmission.

[0056] In this embodiment, first, the server hardware feature extraction module obtains server hardware information data, server real-time running data, and optical network physical layer characteristic data, and processes these data to generate a hardware feature code. The server hardware information data includes CPU serial number data, motherboard serial number data, and hard disk serial number data, which provide unique identification of the device; the server real-time running data includes CPU load data, memory occupancy data, and disk I / O data, which introduce dynamic changes in the time dimension; the optical network physical layer characteristic data includes polarization mode dispersion data, temperature data, mechanical stress data, and device vibration data, which reflect physical disturbances in the optical network transmission environment. Further, by consistent combination processing of the above three types of data, a hardware feature code with high randomness and anti-reproducibility is generated, thereby solving the problem of lack of sufficient randomness and uniqueness in key generation.

[0057] Second, the random number seed is combined with the generated hardware feature code to generate a public key certificate based on the public key infrastructure framework. Specifically, the random number seed introduces additional entropy into the generation process, enhancing randomness, while the hardware feature code embeds the physical characteristics of the server into the certificate system, forming a strong association between the generated public key certificate and the hardware entity. Thus, the risk of certificate forgery in traditional public key infrastructures is avoided, while the security of certificate generation is improved.

[0058] Then, the generated hardware feature code is input into the secure hash algorithm module for processing to generate a fixed-length key. Among them, the hardware feature code is input, intermediate hash data is generated through the iteration compression function, and length adjustment and output formatting processing are performed on the intermediate hash data, and finally a high-strength and irreversible key is generated. Further, through the secure channel and combined with the public key certificate for authentication processing, the generated key is distributed to the communication parties. In this process, the trusted verification mechanism of the public key certificate ensures the confidentiality and anti-forgery of the key in the transmission process, effectively preventing the risk of key leakage.

[0059] Finally, the generated key is used for symmetric encryption algorithm processing of the transmission data to obtain encrypted data. Specifically, the key is used for block processing and round function iteration processing of the transmission data to generate encrypted block data, and the encrypted block data is combined into complete encrypted data and transmitted through the fiber channel of the optical network physical layer. The receiving party uses the same key to decrypt the received encrypted data to recover the original transmission data. Since the key is deeply bound with the physical state of the server and the optical network environment, the encryption process has device specificity and environmental adaptability, thereby significantly improving the security of data transmission, solving the problem of key leakage caused by malicious software attack in traditional methods. In this way, the scheme fuses the server hardware features and the optical network physical layer characteristics to construct a high-security key distribution mechanism, effectively addressing the security risks existing in traditional key distribution.

[0060] In a feasible implementation, the step of obtaining server hardware information data, server real-time running data and optical network physical layer characteristic data through the server hardware feature extraction module and performing combination processing to generate a hardware feature code includes: obtaining server hardware information data through the server hardware feature extraction module; the server hardware information data includes CPU serial number data, motherboard serial number data and hard disk serial number data; obtaining server real-time running data through the server hardware feature extraction module; the server real-time running data includes CPU load data, memory occupancy data and disk I / O data; obtaining optical network physical layer characteristic data through the server hardware feature extraction module; the optical network physical layer characteristic data includes polarization mode dispersion data, temperature data, mechanical stress data and device vibration data; performing consistent combination processing on the server hardware information data, the server real-time running data and the optical network physical layer characteristic data to generate the hardware feature code.

[0061] In this embodiment, the server hardware information data refers to a set of inherent attributes that can uniquely identify the server hardware, which can be implemented by CPU serial number data, motherboard serial number data and hard disk serial number data, aiming to ensure that the hardware feature code has inherent uniqueness and stability of the device. Among them, the server real-time running data refers to a set of dynamic indicators reflecting the current running state of the server, which can be implemented by CPU load data, memory occupancy data and disk I / O data, aiming to introduce the randomness of the time dimension, so that the hardware feature code changes in real time with the actual load of the server. In addition, the optical network physical layer characteristic data refers to a set of parameters describing uncontrollable external disturbances in the optical network transmission process, which can be implemented by polarization mode dispersion data, temperature data, mechanical stress data and equipment vibration data, aiming to capture the physical channel characteristics and enhance the unpredictability and anti-interference ability of the hardware feature code.

[0062] In this embodiment, the above scheme effectively solves the problem of insufficient reliability of the hardware feature code by integrating multi-dimensional data sources and introducing consistent combination processing logic. First, the server hardware information data, as a static hardware identifier, provides the uniqueness and stability of the basic features, avoiding the easy copying or forgery of the feature code due to the variability of the software layer. Second, the server real-time running data, as a dynamic running state indicator, introduces the randomness of the time dimension, so that the hardware feature code can change in real time with the server load, thereby resisting replay attacks based on historical data. Third, the optical network physical layer characteristic data, as a physical environment parameter, captures the uncontrollable external disturbances in the optical network transmission, deeply binds the hardware features with the physical channel characteristics, and makes up for the defects of pure software methods in the physical layer security. Finally, by consistently combining the above three types of data, the correlation between the data is quantified and normalized and fused, ensuring that the static identifier, dynamic state and physical environment are coordinated and unified, avoiding distortion of the feature code due to data conflict or redundancy, thereby generating a highly reliable and consistent hardware feature code.

[0063] On this basis, the above scheme is combined with the hardware feature code generation mechanism proposed in the previous step, and by specifying the specific specifications of the data source and combination logic, the consistency and reliability of the hardware feature code are significantly improved, laying a solid security foundation for the subsequent key generation and distribution link.

[0064] In this embodiment, the step of consistently combining the server hardware information data, the server real-time running data and the optical network physical layer characteristic data to generate the hardware feature code includes: performing correlation calculation processing on the server hardware information data, the server real-time running data and the optical network physical layer characteristic data to quantify the consistency between the data; based on the result of the correlation calculation processing, performing normalization and fusion processing on the data to generate the hardware feature code.

[0065] In this embodiment, the correlation calculation processing refers to analyzing the correlation degree between different data sources by mathematical or statistical methods, and the purpose is to quantify the consistency between the server hardware information data, the server real-time running data and the optical network physical layer characteristic data. In practical application, statistical methods such as Pearson correlation coefficient and Spearman rank correlation coefficient can be used to realize. The normalization processing refers to unifying different dimensions and ranges of data to the same scale, and the purpose is to eliminate the deviation caused by data heterogeneity, and methods such as min-max normalization and Z-score standardization can be used to realize. The fusion processing refers to the process of generating a single feature code according to the correlation weight of all data, and the purpose is to ensure that the generated hardware feature code can fully reflect the real-time state of the server and the optical network, and methods such as weighted average method and principal component analysis can be used to realize.

[0066] In this embodiment, the above scheme introduces correlation calculation processing, first quantitatively analyzes the internal correlation between server hardware information data, server real-time running data and optical network physical layer characteristic data, thereby capturing the cooperative change law between static hardware identification, dynamic running state and physical layer environment parameters. On this basis, the normalization processing is performed on the quantization result, and the data with different dimensions and ranges are unified to a comparable scale, avoiding the deviation caused by data heterogeneity. Subsequently, based on the normalized data, a high-entropy hardware feature code is generated through fusion processing, ensuring that it can fully reflect the real-time state of the server and the optical network. This process not only solves the security risks caused by inaccurate data combination, but also significantly improves the randomness and anti-cracking ability of the hardware feature code, providing a high reliability and uniqueness basis for subsequent key generation. In addition, the above scheme is closely combined with the hardware feature extraction and key distribution process in the pre-information, and the cooperative change law between multi-dimensional data is dynamically captured, further strengthening the security boundary of the entire key distribution process.

[0067] In a feasible implementation manner, the step of generating a public key certificate based on a public key infrastructure framework using the random number seed and the hardware feature code includes: obtaining the random number seed and combining it with the hardware feature code to generate key pair data; inputting the key pair data into a certificate authority center of the public key infrastructure framework for signature and verification processing to generate the public key certificate.

[0068] In this embodiment, the random number seed refers to a random number value sequence with high entropy characteristics, which can be realized by physical noise source collection, pseudo-random number algorithm generation, etc. In practical application, the purpose of introducing the random number seed is to improve the unpredictability in the key generation process, thereby effectively avoiding the security risks caused by fixed patterns. The hardware feature code refers to a unique identification data generated by combining server hardware information data, server real-time running data and optical network physical layer characteristic data, which can be generated by consistency combination processing or correlation calculation processing, etc. The purpose of designing the feature code is to utilize the physical uniqueness of the server hardware to ensure that the generated key pair data is not reproducible. The key pair data refers to a pair of encryption data composed of a public key and a private key, which can be generated by elliptic curve cryptography algorithm or RSA algorithm, etc. The purpose is to provide a basis for subsequent signature and verification processing.

[0069] In this embodiment, the above scheme solves the problem of weak public key certificate security mechanism by refining the core steps of certificate generation processing. First, the combination processing of random number seed and hardware feature code fully utilizes the physical uniqueness of hardware feature code and the high entropy characteristics of random number seed, ensuring that the generated key pair data not only inherits the non-reproducible features of server hardware, but also integrates dynamic random factors, thereby significantly improving the randomness and anti-prediction ability of key generation. Second, the key pair data is input into the certificate authority center of the public key infrastructure framework for signature and verification processing. This process guarantees data integrity through the digital signature mechanism of the authoritative center, and strictly confirms the authenticity of the server identity in combination with the identity verification link, effectively blocking the possibility of certificate tampering and forgery. In addition, the above scheme is closely related to the hardware feature code generation process, which combines the physical layer dependency of hardware feature code with the cryptographic rigor of the public key infrastructure framework, to build a closed-loop security link from hardware features to certificate generation, providing a solid identity authentication foundation for subsequent key distribution. In this way, not only the security of the public key certificate generation process is enhanced, but also the risks of man-in-the-middle attack and forgery are effectively resisted, providing reliable technical support for optical network physical layer key distribution.

[0070] In a feasible implementation, the step of inputting the key pair data into the certificate authority center of the public key infrastructure framework for signature and verification processing to generate the public key certificate includes: using a digital signature algorithm to sign the key pair data to obtain signature data; and binding and verifying the signature data with server identity information to generate the public key certificate.

[0071] In this embodiment, the digital signature algorithm refers to an encryption technology based on mathematical principles, which can be implemented by using RSA algorithm, DSA algorithm or ECDSA algorithm, and the purpose is to ensure the irreversibility and tamper resistance of the signature process through strong encryption characteristics. Among them, the signature data refers to the result generated by encrypting the key pair data, which can be generated by using a hash function combined with a private key encryption method, and the purpose is to make the signature and the specific key form a unique binding relationship, so as to prevent the attacker from destroying the certificate integrity by key replacement or forgery means. In addition, the server identity information refers to a set of data used to identify the uniqueness of the server, which can include server IP address, domain name information or device serial number, and the purpose is to ensure that the public key certificate strictly corresponds to the server identity by deeply embedding the identity information into the signature verification process.

[0072] In this embodiment, the above scheme introduces a digital signature algorithm to sign the key pair data, which significantly improves the security of the signature by virtue of its irreversibility and tamper resistance. On this basis, the signature data and the server identity information are bound and verified, which not only realizes the double confirmation of the identity authenticity, but also effectively blocks the certificate forgery path. For example, in the signature processing stage, the RSA algorithm is used to encrypt the key pair data to generate unique signature data; then, in the binding and verification stage, the signature data is associated with the server IP address and domain name information, and strict verification logic is performed by the certificate authority center to ensure that the generated public key certificate has high credibility. This process, combined with the key pair data generation link in the previous scheme, further strengthens the security foundation of the public key certificate, providing a solid guarantee for subsequent key distribution, not only solving the problem of lack of standardized algorithm specification for signature processing, but also eliminating the risk of certificate forgery and identity impersonation through the improved association mechanism between server identity information and signature data, thereby significantly improving the overall security of the optical network physical layer key distribution process.

[0073] In a feasible implementation, the step of processing the hardware feature code using a secure hash algorithm to generate a key and authenticating using the public key certificate to distribute the key to the communication parties through a secure channel includes: inputting the hardware feature code into a secure hash algorithm module for processing to generate a fixed-length key; and distributing the key through a key agreement protocol and authentication using the public key certificate to ensure the security and anti-forgery of the key during transmission.

[0074] In this embodiment, the secure hash algorithm module refers to a cryptographic function component that can receive input of arbitrary length and output fixed-length results, which can be implemented using standardized hash algorithms such as SHA-256, SHA-3, etc., with the purpose of using its one-way and collision resistance to ensure the security of key generation. The key agreement protocol can be understood as an interactive mechanism that allows communication parties to securely negotiate shared keys on public channels, and its possible implementation includes the Diffie-Hellman key exchange protocol or the elliptic curve Diffie-Hellman protocol, with the purpose of preventing man-in-the-middle attacks and forgery. The public key certificate is a digital file containing the public key and the identity information of its holder, which is usually issued by a trusted certificate authority, with the purpose of verifying the authenticity of the identity of the communication party.

[0075] In this embodiment, in the above scheme, the hardware feature code is first passed as input to the secure hash algorithm module, which generates a fixed-length key by iteratively compressing and formatting the input data. This process takes full advantage of the high uniqueness and dynamic change characteristics of the hardware feature code, ensuring the unpredictability of the key. Subsequently, through the key agreement protocol, the communication parties conduct identity authentication and key negotiation based on their respective public key certificates. The public key certificate plays a key role in this process, not only verifying the authenticity of the identity of the communication parties, but also preventing potential identity impersonation risks. Finally, the negotiated key is distributed through a secure channel, and the entire transmission process is protected by encryption, effectively resisting eavesdropping, tampering, and forgery attacks. In addition, this scheme, combined with the aforementioned hardware feature code generation method, further enhances the uniqueness and security of the key, significantly improving the overall reliability of key distribution. In this way, the security and anti-forgery of the key distribution process are effectively guaranteed, solving the problem of vulnerability to man-in-the-middle attacks and forgery in traditional key distribution methods.

[0076] In a feasible implementation, the step of inputting the hardware feature code into the secure hash algorithm module for processing to generate a fixed-length key includes: inputting the hardware feature code, processing it through an iterative compression function to generate intermediate hash data; and performing length adjustment and output formatting on the intermediate hash data to generate the fixed-length key.

[0077] In this embodiment, the iterative compression function refers to a mathematical operation process based on a multi-round confusion mechanism, which can be implemented by using the compression function in the SHA series algorithm, the compression function in the MD series algorithm, etc. The purpose of introducing this function is to fully disrupt the statistical regularity of the input data through multi-round iteration processing, thereby improving the randomness and collision resistance of the output data. Length adjustment refers to the process of accurately controlling the number of bits of the intermediate hash data, which can be implemented by truncation, padding or extension operations, the purpose is to ensure that the output key strictly meets the length specification of the symmetric encryption algorithm. Output formatting processing refers to the process of standardizing the conversion of the final key data, which can be implemented by byte alignment, encoding conversion, etc., aiming to strengthen the uniform distribution characteristics of the key and prevent the key from being predicted or cracked.

[0078] In this embodiment, the above scheme effectively solves the problems of inconsistent length and insufficient security that may exist in the key generation process by explicitly defining the internal processing mechanism of the secure hash algorithm. First, the hardware feature code, as the only and dynamic input data, can significantly eliminate potential structural weaknesses after multi-round processing by the iterative compression function, generating high-entropy intermediate hash data. This process fully utilizes the dynamic change characteristics of the hardware feature code, ensuring that the intermediate hash data generated each time has high randomness. Subsequently, by adjusting the length of the intermediate hash data and performing output formatting processing, the fixed length of the key is guaranteed, and the security of the key is further enhanced. This step-by-step processing method, combined with the generation process of the aforementioned hardware feature code, makes the key have both sufficient randomness and meet the strict requirements of the optical network physical layer for key stability and reliability during the generation process. Through the above technical scheme, the generated key can effectively resist cryptographic attacks, while ensuring high security and reliability during transmission in the optical network physical layer.

[0079] In a feasible implementation, the step of transmitting the encrypted data through the optical network physical layer includes: using the key to perform block processing and round function iteration processing on the transmission data to obtain encrypted block data; combining the encrypted block data into the encrypted data and transmitting the encrypted data through the fiber channel of the optical network physical layer.

[0080] In this embodiment, the block refers to the actual size and structure of the transmission data characteristics, divided into several small-scale data units suitable for encryption operations. In practical applications, it can be achieved by using fixed length block or dynamic length block, the purpose is to ensure that the encryption process can be efficient to adapt to different size of data stream. Round function iteration processing is a kind of multi round nonlinear transformation operation based on key, which can be realized by standard round function in a variety of encryption algorithms, such as SubBytes, ShiftRows, MixColumns and AddRoundKey operation in AES algorithm, the purpose is to significantly enhance the complexity and randomness of encryption algorithm, so as to prevent the attack of single data block of cryptanalysis.

[0081] In this embodiment, the above scheme can effectively improve the reliability and anti attack ability of data security transmission by refining the specific operation process of encryption and transmission. First, by dynamically blocking the transmission data, the encryption operation can be flexibly adapted to different size of data stream, avoiding the efficiency problem caused by too large or too small data size. Secondly, the round function iteration processing based on key implements multi round nonlinear transformation for each data block, which enhances the complexity and randomness of encryption algorithm, thus ensuring the confidentiality of encrypted data. On this basis, the encrypted block data is re integrated into complete encrypted data stream, and is transmitted continuously through the fiber channel of optical network physical layer, which fully utilizes the inherent low noise, high bandwidth and anti electromagnetic interference characteristics of optical network physical layer, reduces the risk of data being eavesdropped or tampered in the transmission process. In addition, the scheme combines with the previous steps of generating hardware feature code, public key certificate authentication and key distribution, forming a complete key distribution and data encryption transmission system, which further improves the guarantee ability of data integrity and confidentiality in optical network environment.

[0082] In a feasible implementation, the method further comprises: monitoring the encrypted data in the optical network physical layer transmission process in real time to detect whether there is abnormal transmission behavior; if abnormal transmission behavior is detected, the transmission is immediately interrupted, and a security warning mechanism is started, and the related information of abnormal transmission is recorded for subsequent analysis and processing.

[0083] In this embodiment, real-time monitoring refers to identifying abnormal fluctuations in the transmission signal by continuously collecting and analyzing optical network physical layer characteristic data (such as polarization mode dispersion, temperature, and mechanical stress). It can be implemented using machine learning-based anomaly detection algorithms or rule engines, aiming to discover potential threats in a timely manner and avoid missing security risks specific to the physical layer by relying on high-level protocols. Abnormal transmission behavior can be understood as abnormal fluctuations caused by fiber tapping, environmental interference, or equipment failure, which can be determined by comparing historical data patterns or setting threshold ranges, aiming to accurately capture subtle disturbances in the early stages of attacks. The security warning mechanism refers to a response system that automatically activates the alarm system or coordinates defense measures based on real-time monitoring results. It can be implemented using a distributed alarm platform or a multi-level linkage protection architecture, aiming to shorten the threat handling period and enhance the system's active defense capabilities. Recording relevant information about abnormal transmission refers to the process of persistently storing contextual data (such as time, type, and physical layer parameters) of abnormal events, which can be implemented using blockchain technology or a distributed database system, aiming to provide empirical evidence for security policy optimization, enabling the system to extract rules from historical events.

[0084] In this embodiment, the scheme effectively addresses the shortcomings of the basic key distribution method in the transmission security layer by introducing a dynamic monitoring and response mechanism for the physical layer transmission process of the optical network. First, by monitoring encrypted data in real-time during the physical layer transmission process of the optical network, subtle disturbances in the transmission signal can be accurately captured, such as abnormal fluctuations caused by fiber tapping or environmental interference, thereby identifying potential threats in the early stages of attacks. Second, when abnormal transmission behavior is detected, the system will trigger an immediate response based on real-time monitoring results, ensuring that data flow is cut off at the moment of confirming the anomaly, preventing unauthorized parties from obtaining sensitive information through continuous monitoring. On this basis, the security warning mechanism will automatically activate based on real-time feedback from anomaly detection, without the need for human intervention to start defense measures, significantly improving response efficiency. Finally, by persistently storing contextual data of abnormal events, reliable data support is provided for subsequent analysis and processing, enabling the system to continuously optimize the accuracy and adaptability of the monitoring model, not only solving the problem of lacking real-time monitoring capability for the physical layer transmission behavior of the optical network, but also realizing the transition from passive protection to active evolution, significantly enhancing the security and reliability of the key distribution process.

[0085] In the embodiments of the present application, the server hardware feature-based optical network physical layer key distribution method effectively solves the technical problems of vulnerability of traditional software algorithms, insufficient randomness of keys and poor environmental adaptability by generating a hardware feature code based on deep fusion of server hardware inherent features and optical network physical layer dynamic environment parameters and performing key distribution in combination with a public key infrastructure framework, which can improve the security of key distribution, enhance the randomness and uniqueness of the keys and improve the adaptability of the system to environmental changes.

[0086] It should be noted that the above examples are only used to understand the present application and do not constitute a limitation on the server hardware feature-based optical network physical layer key distribution method of the present application. More forms of simple transformation based on the technical concept are within the protection scope of the present application.

[0087] The present application also provides a server hardware feature-based optical network physical layer key distribution system, which refers to Figure 2 The server hardware feature-based optical network physical layer key distribution system comprises a memory 10, a processor 20 and a server hardware feature-based optical network physical layer key distribution program stored on the memory 10 and capable of running on the processor 20, wherein the server hardware feature-based optical network physical layer key distribution program is configured to implement the steps of the server hardware feature-based optical network physical layer key distribution method.

[0088] The server hardware feature-based optical network physical layer key distribution system provided by the present application adopts the server hardware feature-based optical network physical layer key distribution method in the above embodiments, which can improve the security of key distribution. Compared with the prior art, the server hardware feature-based optical network physical layer key distribution system provided by the present application has the same beneficial effects as the server hardware feature-based optical network physical layer key distribution method provided by the above embodiments, and other technical features in the server hardware feature-based optical network physical layer key distribution system are the same as the features disclosed in the above method embodiments, which will not be described here.

[0089] It should be understood that the parts disclosed in the present application can be realized by hardware, software, firmware or a combination thereof. In the description of the above embodiments, specific features, structures, materials or characteristics can be combined in any one or more embodiments or examples in a suitable manner.

[0090] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any equivalent structural transformation made by using the contents of the present application specification and drawings or directly / indirectly applied in other related technical fields is included in the patent protection scope of the present application.

Claims

1. A method for physical layer key distribution in optical networks based on server hardware characteristics, characterized in that, The method comprises: The server hardware feature extraction module obtains server hardware information data, server real-time running data and optical network physical layer characteristic data, and performs combination processing to generate a hardware feature code; Using a random number seed and the hardware feature code, a certificate generation process is performed based on a public key infrastructure framework to generate a public key certificate; The hardware feature code is processed using a secure hash algorithm to generate a key, and the key is distributed to both parties of communication through authentication processing using the public key certificate through a secure channel; The key is used for symmetric encryption algorithm processing of transmission data to obtain encrypted data, and the encrypted data is transmitted through the optical network physical layer, and the receiving party uses the key to decrypt the encrypted data to recover the transmission data.

2. The method of claim 1, wherein the server hardware feature-based optical network physical layer key distribution method further comprises: The step of generating a hardware feature code by the server hardware feature extraction module to obtain server hardware information data, server real-time running data and optical network physical layer characteristic data, and performing combination processing comprises: The server hardware feature extraction module obtains server hardware information data; the server hardware information data includes CPU serial number data, motherboard serial number data and hard disk serial number data; The server hardware feature extraction module obtains server real-time running data; the server real-time running data includes CPU load data, memory occupancy data and disk I / O data; The server hardware feature extraction module obtains optical network physical layer characteristic data; the optical network physical layer characteristic data includes polarization mode dispersion data, temperature data, mechanical stress data and equipment vibration data; The server hardware information data, the server real-time running data and the optical network physical layer characteristic data are uniformly combined to generate the hardware feature code.

3. The optical network physical layer key distribution method based on server hardware characteristics as described in claim 2, characterized in that, The step of uniformly combining the server hardware information data, the server real-time running data and the optical network physical layer characteristic data to generate the hardware feature code comprises: Correlation calculation processing is performed on the server hardware information data, the server real-time running data and the optical network physical layer characteristic data to quantify the consistency between data; Based on the results of the correlation calculation processing, the data is normalized and fused to generate the hardware feature code.

4. The method of claim 1, wherein the server hardware feature-based optical network physical layer key distribution method is characterized by, The step of using a random number seed and the hardware feature code to generate a public key certificate based on a public key infrastructure framework comprises: The random number seed is obtained and combined with the hardware feature code to generate key pair data; The key pair data is input into the certificate authority center of the public key infrastructure framework for signature and verification processing to generate the public key certificate.

5. The method of claim 4, wherein the server hardware feature is a processor, a memory, a network interface, or a combination thereof. 5 The step of inputting the key pair data into the certificate authority center of the public key infrastructure framework for signature and verification processing to generate the public key certificate comprises: The key pair data is signed using a digital signature algorithm to obtain signature data; The signature data is bound and verified with server identity information to generate the public key certificate.

6. The method of claim 1, wherein the server hardware feature-based optical network physical layer key distribution method further comprises: The step of processing the hardware feature code using a secure hash algorithm to generate a key and distributing the key to both parties of communication through authentication processing using the public key certificate over a secure channel comprises: processing the hardware feature code into a secure hash algorithm module to generate the fixed-length key; distributing the key over a secure channel through key agreement protocol and authentication processing using the public key certificate to ensure the security and anti-forgery of the key during transmission.

7. The method of claim 1, wherein the server hardware feature-based optical network physical layer key distribution method further comprises: The step of processing the hardware feature code into a secure hash algorithm module to generate the fixed-length key comprises: processing the hardware feature code as input through an iterative compression function to generate intermediate hash data; adjusting the length of the intermediate hash data and formatting the output to generate the fixed-length key.

8. The method of claim 1, wherein the server hardware feature-based optical network physical layer key distribution method further comprises: The step of using the key to perform symmetric encryption algorithm processing on the transmission data to obtain encrypted data and transmitting the encrypted data through the optical network physical layer comprises: using the key to perform block processing and round function iteration processing on the transmission data to obtain encrypted block data; combining the encrypted block data into the encrypted data and transmitting the encrypted data through the fiber channel of the optical network physical layer.

9. The method of claim 1, wherein the server hardware feature-based optical network physical layer key distribution method further comprises: The method further comprises: real-time monitoring of the encrypted data during the transmission of the optical network physical layer to detect whether there is abnormal transmission behavior; if abnormal transmission behavior is detected, immediately interrupting the transmission and starting a security warning mechanism, while recording relevant information of the abnormal transmission for subsequent analysis and processing.

10. A server hardware feature based optical network physical layer key distribution system, comprising: The optical network physical layer key distribution system based on server hardware features comprises a memory, a processor, and an optical network physical layer key distribution program based on server hardware features stored on the memory and executable on the processor, and the optical network physical layer key distribution program based on server hardware features is configured to implement the steps of the optical network physical layer key distribution method based on server hardware features as claimed in any one of claims 1 to 9.

Images